string-out-stream: gc issue.

The problem being addressed here showed up for me when compiling with
either gcc-7 or gcc-11 on Ubuntu 18, using -fsanitize-undefined.
A few test test cases run under --gc-debug were crashing. I narrowed
it down to this small test case, whose correct output would be "1":

  ./txr --gc-debug -p '(sys:fmt-simple 1 : : : :)'
  "\x6700ACB0缻\x6700ACB0缻 "

The issue doesn't have anything to do with -fsanitize-undefined;
that just how it got reproduced by chance.  I'm reasonably certain
that in builds for which "make tests" passes, and the above test
case doesn't repro, this issue is absent: the code got generated
in such a way that it the string_own call doesn't cause the stream
object to be reclaimed.

* stream.c (get_string_from_stream): change the order of operations in
the ownership transfer of the string from the stream to the returned
string object. We capture the string in a local variable, and null out
so->buf before calling string_own. The problem is that
get_string_from_stream is called in a way where the caller no longer
has any use for the stream, and so the object is no longer live.
It's possible for the string_own call to cause the stream object to be
garbage collected. Therefore, the object must not still be hanging on
to the wchar_t * string, which was already transferred to the string
object.

0 files changed, 0 insertions, 0 deletions